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We propose efficient-phase-encoding protocols for continuous-variable quantum key distribution 
using coherent states and postselection. By these phase encodings, the probability of basis mismatch 
is reduced and total efficiency is increased. We also propose mixed-state protocols by omitting a part 
of classical communication steps in the efncient-phase-encoding protocols. The omission implies a 
reduction of information to an eavesdropper and possibly enhances the security of the protocols. 
We investigate the security of the protocols against individual beam splitting attack. 
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I. INTRODUCTION 

In quantum key distribution (QKD), two distant parties, 
Alice and Bob share a secret key exploiting quantum channel 
and classical communication. By the laws of quantum physics 
the key can be proved to be secure against an eavesdropper 
(Eve) who has advanced technologies |1]]. Many novel and 
modified QKD protocols have been proposed based on var- 
ious theoretical and experimental aspects. For example, in 
the standard weak-coherent-state (WCS) implementation of 
the BB84 protocol, the transmission distance of QKD is lim- 
ited by the photon-number-splitting (PNS) attack 0. To de- 
feat this limitation, modifications of the implementation have 
been proposed. An elegant one is the SARG protocol which 
changes the classical communication step in the implementa- 
tion y|. Another one is the decoy-state protocols that utilize 
fake signals to restrict possiblility of the PNS attack 

A different type of WCS implementation has been proposed 
combining the idea of the balanced homodyne detection of an 
weak signal field with a strong field in the phase-encoding in- 
terferometric implementation of the BB84 protocol 6|. This 
proposal also includes the idea of postselection in continuous 
variable (CV) QKD. Following BB84, the protocol has inef- 
ficiency of basis mismatch associated with the random ba- 
sis exchange, the choice of the quadratures. However, there 
are several CV QKD protocols that have no such inefficiency 
fH 1st Isl fioll . In relation with the implementation, those pro- 
tocols employ the amplitude modulations in addition to the 
phase modulation, and the signals are not necessarily WCS. 
Although CV QKD protocols are free from the limitation by 
the PNS attack, another practical limitation is given by the 
classical teleportation attack [Til IT^|. 

In this paper we propose efficient phase-encoding protocols 
for CV QKD using balanced homodyne detection and posts- 
election those have better efficiency than the original one |(| 
without significant changes in experimental setup. We also 
propose mixed-state protocols by omitting the part of classi- 
cal communication steps. 

In Sec. II, we review the original protocol and provide a 
basic notation. In Sec. Ill, we present modified protocols. In 



Sec. IV, we investigate the security against individual beam 
splitting attack. Sec. V is the conclusion and remarks. 



II. ORIGINAL FOUR-COHERENT-STATE 
POSTSELECTION PROTOCOL 

The original four-state postselection protocol (04) 0, IT^| 
is based on the phase-encoding interferometric implementa- 
tion of QKD and the balanced homodyne detection of a weak 
signal field with a strong field as in FIG.0 
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FIG. 1: The pulse emitted from a light source (LD) is split 
into a strong local oscillator (LO) and a weak signal field by 
an asymmetric beam splitter (ABS). Alice applies her phase 
shift (f>A to the signal and Bob applies his phase shift 4>b 
to the LO. The signal and LO interfere at the 50:50 beam 
splitter (BS). The difference between the photon numbers of 
the output pulses of the BS is observed. 

Alice sends the coherent state |ae*'* A ) with a > by 
randomly choosing her phase modulation <j>A from a set 
{0, 7r/2, 7r, 3n/2}. Bob measures the quadratures x{4>b) = 
xi cos 4>b+X2 sin rf>B by randomly choosing his phase modula- 



tion 4>b from a set {0, 7r/2} where x\ = "t" and £2 — — ; — 
Bob's measurement is characterized by the quadrature dis- 
tribution of the coherent state \{xtf, g |ae l< * A )| 2 where (xcf, B \ is 
the eigenbra of x((/>b) with the eigenvalue x^ B . For a simpler 
notation we define 
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P(x,a, 



cxp { — 2(x — q cos 4>) 2 } ■ 



(1) 



Then, we can write 

| {x^ B \ae^ A ) | 2 = P{x^ B ,a,^-M (2) 

After the transmission, Bob informs Alice of his phase shift 
4>b- If \4>a — 4>b\ = {0,7r}, Bob's distribution is one of the 
Gaussian distributions centered either at ±a as in FIG.El We 
call such a combination of (4>a,<Pb) the correct basis and the 
quadrature distribution is given by 

P B (x,a) = |(P(as,a,0)+P(«,o,7r)), (3) 
where x corresponds to Bob's measurement outcome. 
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FIG. 3: Phase-space picture of the original four-state protocol 
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FIG. 2: The quadrature distributions of correct-basis choice 
are shown. The solid curve peaked at x — a corresponds to 
the signal of Alice's bit "1" and the dotted line peaked at 
x — —a corresponds to the signal of Alice's bit "0". 

For the correct-basis case, the signal can transfer bit in- 
formation from Alice to Bob by the following manner. Alice 
encodes her bit according to the combination of (4>a, 4>b) as in 
Table H] Bob decodes the bit value according to his outcome 
x: If x > his bit value is "1" otherwise his bit value is "0". 
The bit error rate (BER) conditioned on the absolute value 
| a; | is given by 

i r- \ p (\x\,VV(x,n) 

= P(\x\,Vv*,0) + P(HVV<*,iry W 

where we assume the lossy channel with the line transmission 
rj, (0 < r\ < 1). Since the quadrature distributions are spread 
and overlapped, Bob's positive (negative) quadrature result 
needs not correspond to Alice's bit "1" ("0") and Bob's de- 
coding has inherently finite errors. However, qs is less than 
| if x 7^ and non-zero information is transferred. By select- 
ing the data according to the value of x, Alice and Bob can 
discard the erroneous portion. This process is called postse- 
lection. 

If (\4>a — 4>b\ mod 7r) = 7r/2, the signal is called the wrong 
basis. In this case, they cannot share the bit information 
because Bob's quadrature distribution is the same for such 
a combination of <j>A and <pB, and the wrong-basis signal is 
discarded. 

TABLE I: Alice's bit encoding of the original four-state pro- 
tocol 



<pA 








tt/2 


tt/2 


7T 


7T 


3tt/2 


3rr/2 


<t>B 





tt/2 





tt/2 





rr/2 





tt/2 


(x) 


a 








a 


— a 








— a 


A 


1 






1 













We define the efficiency P e of the protocol as the probability 
that the signal becomes correct basis. In this 04 protocol one- 
half of signals are discarded and 

P ' = \ <*> 

In the modified protocols, this quantity will be improved. 

Alice's bit encoding of the 04 protocol associated with 
4>a, 4>b, and Bob's mean value of quadratures (x) = 
) is summarized in Table I where A rep- 
resents Alice's bit. For the combination of wrong basis, (£} 
is zero and A is set to be blank. The probability of wrong 
basis is determined by the number of blanks in the row A. A 
phase-space description is shown in FIG.|H] 

Towards the modification, the essential point of performing 
the postselection is that Bob's distribution takes the form like 
FIG. [5] As we will show, the state configuration of FIG|3| 
and the random choice of a conjugate-quadrature pair is not 
necessary. 

For a convenience, we set Alice's bit encoding rule: The 
combination of (<f>A,<j>B) that leads to (x) — is for wrong 
basis, (x) — a is for bit "1" and (x) — —at is for bit "0". 
Note that Table I is consistent with this rule. We use this 
rule repeatedly in the following section. 

The security of the protocol can be related to the uncer- 
tainty relation of the quadratures, 

(Ax.fiAx,) 2 > -L. (6) 

Let us consider the ideal case, i.e., the channel and detector 
are lossless and noiseless. In such a case Bob can measure the 
mean and variance of xi and £2 for each of the four coherent 
states and confirm that each of the states is in the minimum 
uncertainty state with (Axi) 2 = (AX2) 2 = \- Since such 
a minimum uncertainty state is a pure coherent state, this 
implies that a set of non-orthogonal states transfers without 
any disturbance. Thus, there is no Eve's intervention if the 
variances and mean values of quadratures have no changes, 
and the minimum uncertainty ensures the security. 



III. EFFICIENT POSTSELECTION 
PROTOCOLS 

In this section we present several modified protocols. 
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A. Three-state protocol 




FIG. 4: Phase-space picture of the three-state protocol 



TABLE III: Alice's bit encoding for the efficient four-state 
protocols 



4>A 


tt/4 


tt/4 


3tt/4 


3tt/4 


5tt/4 


5tt/4 


7n/i 


7tt/4 


4>B 





tt/2 





tt/2 





tt/2 





tt/2 


(x) 


OL 


a 


— a 


ol 


— a 


— a 


a 


— a 


A 


1 


1 





1 








1 






and we obtain 



(Aa;i) — - I + {(xix 2 + f 2x1} — 2(xi)(x2}) tan^) 



Since this relation holds for both <f> = — 7r/6 and 
in the three-state protocol, we obtain 



(An) 



0. (9) 

-5tt/6 

(10) 



The encoding of the three-state protocol is schematically 
described on the phasespace as in FIG. [I] (The "l"s and 
"0"s in FIG. EJrepresent Alice's bit encoding associated with 
Bob's basis). Alice sends the coherent state \a'e t< '' A ) with 
4>a = {0, 2tv/3, 47r/3} and a' = -j^cx. Bob measures x{4>b) 
with cj>B = {y/2, — 7r/6, — 5ir/6}. We can easily see that if 
(\4>a — 4>b\ mod 7r) is different from 7r/2, then the quadra- 
ture distribution takes the form of the one in FIG. [5] In such 
a condition, we can perform the postselection procedure. If 
(\4>a — 4>b\ mod 7r) = 7r/2, the combination of (</>a,</>b) is 
wrong basis and discarded. 

Using Alice's bit encoding rule in Sec. II, we obtain Table 
II. From Table II, we can see that the wrong-basis case occurs 
with probability 1/3. Thus, the efficiency is 



Pe = 



2 

3' 



(7) 



B. Efficient four-state protocols 



-a(1- i)> 
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o 

|-a(l+i)> 



|a(l+i)> 



o 



o 



|a(i- i)> 



which is 4/3 times higher than that of the 04 protocol. 



FIG. 5: Phase-space picture of the efficient four-state protocol 



TABLE II: Alice's bit encoding of the three-state protocol 



<t>A 











2tt/3 


2tt/3 


2tt/3 


4tt/3 


4tt/3 


4tt/3 


<pB 


tt/2 


-tt/6 


-5tt/6 


tt/2 


-tt/6 


-5tt/6 


tt/2 


-tt/6 


-5tt/6 


(x) 





ol 


— OL 


OL 


— a 





— a 





a 


A 




1 





1 












1 



This encoding is based on the idea that Alice applies dif- 
ferent encoding according to Bob's choice of basis. In CV 
QKD protocols, an efficient encoding where two variables are 
encoded on two conjugate quadratures has already been com- 
mon. Our proposal can be interpreted as a generalization 
of this idea, namely, we encode two values on non-conjugate 
quadratures. 

As a security aspect of the three-state protocol, it should 
be checked whether the minimum uncertainty is confirmed in 
the case Bob measures three different quadratures. Suppose 
that Bob observes (A12) 2 = \ and (Aa;^) 2 = j. Then, from 
the definition of x((p), 

(Axe/,) 2 = {(xi cos 4> + £2 sin <fi) 2 — {xi cos <p + £2 sin <j>) 2 ) 
= (Aii) 2 cos 2 <p + (AX2) 2 sin 2 (f> 

+ {{X1X2 + X2X1) — 2(xi)(x2}) sin 0cos <j>, (8) 



The encoding of the efficient four-state (E4) protocol is 
schematically described in FIG.Q3 Alice sends \a"e l ^ A ) with 
4>A = {7r/4, 37r/4, 57r/4, 77r/4} and a" = \/2a. Bob mea- 
sures x(4>b) with <pB = {0,7r/2}. After the transmission (i) 
Bob informs Alice of his phase. Then, (ii) Alice tells Bob 
that her preparation of the states belongs to which one of 
the four sets {|a"e I7r / 4 ), |a"e 3l7r / 4 ) }, {ja/'e 3 " 1 '' 4 ), jaV 5 ^ 4 )}, 
{|a"e 5,7r/4 ),|a"e 7l7r / 4 )}, and {\a" e 7l7r / 4 } , |a"e I7r / 4 )} accord- 
ing to Bob's choice of the phase. Namely, if tps = 0, Alice tells 
Bob that the state belong to either \\a"e i7l/i ), |a"e 3l7r/4 )} 
or {\a"e 5l7v/4 },\a"e 7ln/4 }}. If 4> B = tt/2, Alice tells Bob 
that the state belong to either {|a"e 3l7r/4 ) , \a"e l57r/4 ) } or 
{laV^JaV^ 4 )}. 

In every case, the state takes the form similar to the one 
in FIG. [5] and we can perform the postselection procedure. 
Thus, the efficiency is 

Pe = 1. (11) 

This is also clear from the configuration of the states in FIG. 
Applying Alice's bit encoding rule we obtain Table III. 

Now we present another four-state protocol by modifying 
the classical communication step of the E4 protocol. Let us 
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assume that Alice omits the announcement (ii), then the pro- 
tocol still works without any further modification and the 
information that Alice and Bob share does not change. This 
is because Bob's distribution and bit decoding do not depend 
on the announcement (ii). The information is encoded on the 
pairs of the states, and it is not necessary to identify the states 
in each pair. Therefore, the redundant state information need 
not be announced. 

This modification possibly enhances the security because 
Eve cannot exploit the classical information (ii). The loss of 
the information can be described by using the terms of mixed 
states. From Eve's point of view, Alice's preparation of states 
is not in a set of pure coherent states but in a set of mixtures 
of coherent states. We call this modified protocol the mixed 
state protocol based on the four states (MB4). 

We have seen that the postselection protocol can be demon- 
strated without wrong-basis signal as in other CV QKD pro- 
tocols. Conversely, if there are wrong-basis signals in a phase 
encoding CV QKD as in the 04 protocol, the signals are 
supposed to have some useful information and may play a 
role of the decoy states. Namely, the wrong-basis signals re- 
strict Eve's possible operations. Such aspect has already been 
pointed out in Refs. [a. H^|. 



C. Six-state protocols 

In a similar manner to the E4 and MB4 protocols, we can 
find a six-state protocol and its mixed-state version. 




FIG. 6: Phase-space picture of the six-state protocol 



The encoding of the six-state protocols can be schemati- 
cally described on the phasespace as in FIG. El Alice sends 
\a'e i,t>A ) with <p A = mvr/3, m = {0, 1, 2, • • • ,5}. Bob mea- 
sures x(4>b) with <f)B = {tt/2, — 7r/6, — 5n/6}. The configura- 
tion of the six-state protocol in FIG.|S|has a similar symmetry 
to that of the three-state protocol in FIG. 21 If we make a 
mirror reflection of the three states associated with any one 
of the measured axes on the phasespace, we can obtain the 
six-state configuration. 

From Fig. [(J we can see that if (\4>a — 4>b\ mod 7r) is 
different from tv/2, the quadrature distribution takes the form 
similar to the one in Fig. [3] In such a condition, we can 
perform the postselection procedure. The other cases, i.e., 
(\4>a — 4>b\ mod 7r) = 7r/2, are for wrong-basis result. 

Using the bit encoding rule, we can obtain Table IV. From 
Table IV, we can see that the efficiency is 



Pe = f, (12) 



which is equivalent to that of the three-state protocol. 



TABLE IV: Alice's bit encoding of the six-state protocols 



<t>A 











tt/3 


tt/3 


tt/3 


2tt/3 


2tt/3 


2tt/3 


7T 


7T 


7T 


4tt/3 


4tt/3 


4tt/3 


5tt/3 


5-7r/3 


5tt/3 


4>B 


tt/2 


-tt/6 


-hir/6 


tt/2 


-tt/6 


-5tt/6 


tt/2 


-tt/6 


— 5tt/6 


tt/2 


-tt/6 


— bn/6 


tt/2 


-tt/6 


-5tt/6 


tt/2 


-tt/6 


-5tt/6 


(£) 





a 


— a 


a 





— a 


a 


— a 








— a 


a 


— a 





a 


— a 


a 





A 




1 





1 







1 












1 













1 





The classical communication step in the six-state protocol 
is as follows: (i) Bob informs Alice of his phase <f>B and then 
(ii) Alice tells Bob that her preparation of the states is wrong 
basis or belongs to either two-state subset in the one of the 



three sets 

{{\a'e* n/3 ), |a'e 5l?r/3 )}, {\a'e 2,w/3 ), \a'e 4lw/3 ) }} , (13) 
{{|a'),|a' e 2 ^ 3 )},{|a'e^),|a'e 5 ^ 3 )}}, (14) 

and 

{{|a'e" /3 >, |a'0}, {|a'>, |a'e 4 "/ 3 }}} , (15) 
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according to the value of 4>b = t/2, — 7r/6, and — 5vt/6 , re- 
spectively. 

Let us modify the step (ii) as (ii)' Alice tells Bob that her 
preparation of the states is wrong basis or not. Then, the 
protocol still works and the performance is essentially the 
same. This provides the mixed state protocol based on the six 
states (MB6). In this protocol, Alice's preparation of states 
is considered to be one of the equal-probability mixtures of 
the states in one of the subsets. 

Note that all above protocols can be performed essentially 
in the same experimental setup based on the interferometer 
because the modifications are given in the way of phase mod- 
ulation and classical communication steps. 



D. Eight-state protocols 

We describe an eight-state protocol and its mixed-state ver- 
sion. Different from the previous ones, this protocol requires 
not only the phase modulation, but also the amplitude mod- 
ulation in the interferometric implementation. 



FIG. 7: Phase-space picture of the eight-state protocol 
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The encoding of the eight-state protocols can be schemat- 
ically described on the phasespace as in FIG. |7| Alice sends 

coherent state {\ae l ^~ n }, \a"e l 3 w }} by choosing 4>a = 
rmr/2, m = {0, 1, 2, 3} with a and <f> A = (2m' + l)ir/4, m' = 
{0,1,2,3} with a" — s/2a. Bob chooses his phase <f>B = 
{0,tt/2}. 

From FIG. [7| we can see that if {\<j>A — 4>b\ mod ir) is 
different from n/2, the quadrature distribution takes the form 
similar to the one in FIG. 2. In such a condition, we can 
perform the postselection procedure. The other cases, i.e., 
(\4>a — 4>b\ mod 7r) = 7r/2, are for wrong-basis result. Using 
the bit encoding rule, we can obtain Table V. From Table V, 
we can see that the efficiency is 



P, = 



(16) 



which is higher than that of the 04 protocol by the factor of 
3/2. 



TABLE V: Alice's bit encoding of the eight-state protocol 











7T/4 


tt/4 


tt/2 


■n/2 


3tt/4 


3tt/4 


7T 


7T 


5tt/4 


5tt/4 


3tt/2 


3tt/2 


7-n/i 


771-/4 


<t>B 





7T/2 





tt/2 





■n/2 





■n/2 





■n/2 





■n/2 





tt/2 





■n/2 


(x) 


a 





a 


a 





a 


— Oi 


a 


OL 


— a 





— 0( 


— a 





a 


— a 


A 


1 




1 


1 




1 





1 


















1 






In the classical communication step, (i) Bob informs Alice 
of his phase <j>B and then (ii) Alice tells Bob that her prepa- 



ration of the states is wrong basis or belongs to which one of 
the two-state subsets in the two sets 



J 



and 



{{|a>, \ae ln )}, {|a"e 17r/4 ), \a"e Sln/4 )}, {|a"e 5l7r/4 ), ja" e 7 "^ 4 )}} , 

{{|ae 87r/2 ), lae 3 "^ 2 )}, {jaV^ 4 }, \a" e 7 " 174 )}, {|a" e M7T/i ) , |a"e 5l,r/4 )}} 

I 



(17) 



(18) 



according to the value of (j>B = 0, and n/2 , respectively. 



Let us modify the process (ii) as (ii)' Alice tells Bob that 
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her preparation of the states is wrong basis or not. Then, 
still the protocol works and the performance is essentially the 
same. In this case, Alice's preparation of states is considered 
to be a three-state equal-probability mixture. We call this 
modified eight-state protocol the mixed state protocol based 
on the eight states (MB8). The MB8 protocol is considered to 
be a mixture of the 04 and E4 protocols with certain changes 
in the classical communication step. Thus, it is possible to 
switch the protocols by changing the classical communication 
after the transmission. 



E. Generalization of protocols 

We present a generalized mixed-state protocol which in- 
cludes the MB4 and MB8 protocols. This generalization may 
not have practical utility but it is useful for the discussion of 
the security (see Sec. IV). 
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FIG. 8: Phase-space picture of the 4n + 4-state protocol 



The encoding of the generalized protocol can be schemat- 
ically described on the phasespace as in FIG |H| Alice ran- 
domly sends one of the 4n + 4 states, |a(±l + 2(^7 — 1))}, 
|a(±i + (|2L _ i))), k = 0,1,2,- •■ ,n + l, m = 1,2,... ,n. 
Bob measures one of the quadratures, xi or £2 ■ 

Alice encodes bit "1" for \a(l + i(^ - 1))) and "0" for 
|q(— 1 + — 1))} in the case that Bob measures xi. Alice 

encodes bit "1" for \a(i + - 1))} and "0" for \a(-i + 

(-^tj ~ 1))} m the case that Bob measures £2- The other cases 
are discarded. In this protocol, Alice's preparation of states 
is considered to be a n 4- 2-state equal-probability mixture. 
We can see that n — corresponds to the MB4 protocol and 
n = 1 correspond to the MB8 protocol. The efficiency is given 
by 



Pe = 



2 + n 
2 + 2n ' 



(19) 



IV. 



SECURITY AGAINST INDIVIDUAL BEAM 
SPLITTING ATTACK 

A. Individual beam splitting attack 



The safety of the QKD protocols under lossy channel is 
estimated by assuming the beam splitting attack where Eve 
replaces the lossy channel with lossless one and splits the por- 
tion of signal corresponds to the loss. Here we consider the 
individual beam splitting attack where Eve stores the portion 



for arbitrarily long time with a perfect quantum memory and 
she performs her measurement on individual signal indepen- 
dently after she learns Bob's basis of each signal. 

In the present protocols, Alice's preparation of states is 
represented by the form of the coherent-state mixture 



p(pi,cu) = ^2pi\ai){ai\ 



(20) 



The states of Bob and Eve under the beam splitting attack are 
given by p(pi, yffjcti) and p(pi, \/l — rjcu) respectively, where 
1) is the line transmission (0 < 77 < 1). 



B. Eve's knowledge 

Let us assume the situation that Eve receives one of the 
binary states p± whose subscript corresponds to Alice's bit 
encoding and each of them appears with the equal probabil- 
ity, 1 . An upperbound of Eve's knowledge represented by the 
fraction of the bit sequence deleted in the privacy amplifica- 
tion OHIlil is given by 



= log 2 (2-|<V> + |V->| 2 ), 



(21) 



where \ip±) is a purification of p±. This formula is origi- 
nally given for the pure-state signal 1171 . For the case of the 
mixed-state signal, by assuming Eve obtains a purification 
that always includes the original mixed-state signal, we can 
safely estimate an upperbound. A tight estimation of the 
inner product is directly calculated by the fidelity [lfijl 



F(p+,p_) = max|(^+|^->| =Tr^v / AnP-V / 3+ ( 22 ) 



= max 

W>±> 

where the maximization is taken over all the purifications. 

In the following we determine Eve's states under the beam 
splitting attack for each of the protocols and estimate the 
inner product |(i/>+|i/>_}|. It is shown that all of them have 
the same bound of the inner product |{^-|_|^_)| = e ~ 2 ( 1_, ') a , 
which gives the same upperbound of Eve's knowledge. 

For the three-state protocol, Eve's states are given by 



P± 



— / ±- 

r\a e 3 



rja e 



(23) 



assuming that Bob set <f>s = tt/2. Then, taking \ip±) = 
\^/T^7ja'e ± i 7T ), we obtain \(ip + \ip_)\ = e -^-v)^\ The 
same bound can be applied for (f>s = —it/6 and 4>b = — 57r/6 
because in that case p± can be obtained from those in Eq. 

with proper rotations in the phasespace. Similarly we 
omit the discussions of phase-covariant cases in the follow- 
ings. Since the configuration of the six-state protocols can be 
obtained from that of the three-state protocol by the mirror 
reflection. The same bound can be applied to the pure version 
of the six-state protocols. 

For the E4 protocol, Eve's states are given by 



P± 



\VT=rj(l ± i)a)(v / T^(l ± i)a\ 



(24) 



assuming that Bob set </>b = vr/2 and Alice announced her 
preparation was in the pair |(1 ± i)a). Then, taking \tp±) = 
\(l±i)a) we obtain the same bound, \(ip + \ij)-}\ = e^t 1 -'')" 2 . 
For the MB4 protocol, Eve's states are given by 



P± 



\ (| ± v/l - ^(1 + »)a)(±v / T^(l + M 

+ |± v / l _ ^(l-i)Q)(±V / l — ^(l-i) a |) (25) 
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assuming that Bob set <f>B = 0. Using the formula of 
the fidelity in Appendix A, we obtain the estimation F = 
e -2(i— ti)a _ Since Eve's states of the pure version of the eight- 
state protocols is that of either the 04 protocol or the E4 pro- 
tocol. Therefore, the pure version of the eight-state protocols 
also has the same bound. 

For the MB6 protocol, Eve's states are given by 



P± = 



rja e 



,±f 



r\ot e 



+ | x /T^a' e ± ^)( V T 



rja e 



assuming that Bob set 4>b = n/2. Then, using the formula 
of the fidelity in Appendix A again, we obtain the estimation 
p — e -z(i-n)<* 2 _ 

For the generalized protocol including the MB4 and MB8 
protocol, Eve's states are given by 

1 n + l 

P± = — -^|/?±(n,fc))</3±(n,fc)|, (27) 
n + 2 z — ' 



f3 ± (n,k) = V / l-^{±l + »( 2fc Ti ^ - )}, 



(28) 



assuming Bob set 4>b — 0. We can see that the following 
states are purifications of p±, 



n+l 



|^±> = -^=^2\f3 ± (n,k))\k)e ±iujW , (29) 
Vn + 2 f-? 



V n + l 



(30) 



where {|fc}} is an orthonormal basis set of an extended space. 
The bound is given by 



\(i>+\i>-)\ 



-2(l-n)o: 



(31) 



independent of n. 

The purification \ip±) of Eq. (I29H implies that Eve knows 
the extra-state information k which is never announced in the 
mixed-state protocols. Given this information Eve's problem 
is just to distinguish the two pure states |/3±(n, k)). Thus, the 
bound is equal to that of the pure-state case. In this sense, 
the information from the mixed-state signal is upper bounded 
by that of the pure-state case and the omission of the classi- 
cal communication possibly reduces Eve's information. This 
fact suggests that mixed-state protocols are advantageous. 
However, optimization problems for mixed-state signals are 
technically difficult compared with those for pure-state cases 
in general. For the pure-state protocols, the upperbound is 
achievable by the optimal measurement which minimizes the 
error rate. On the other hand, it is not sure that the up- 
perbound can be tight for the mixed-state protocols. If the 
bound is not tight, it implies that the mixed-state protocol is 



more secure. 



C. Formula of secure key gain 

The secure key gain [l4L ITEl IT?| as a estimation of QKD 
performance against individual BS attack for the present pro- 
tocols is given by 

G(a,rj,x ) = P e ^Yl p B(x,Vva)i{qB{\x\, y/rja)) - tJ^2) 



( 26 ) na 



where 

i(q) = 1 + qlog 2 q+(l-q) log 2 (l - q) (33) 

is the mutual information of the binary symmetric channel, 
and r u = log 2 (2 — e _4 ' 1_,? ' c * ) is given from the previous sub- 
section. Since the correct-basis distributions, the BER, and 
t are the same as those of the 04 protocol, the value of the 
gain is the same as that of the 04 protocol (llf except for the 
factor P e . 

In the presence of noise, the estimation of the gain is in 
progress. As long as we use the coherent states and homodyne 
detection the limitation of all the protocols can be found pH . 



V. CONCLUSION AND REMARKS 



We have proposed several phase-encoding protocols for 
quantum key distribution using coherent states and postse- 
lection. The modified phase encodings reduce the probability 
of wrong basis and increase the efficiency. The proposed pro- 
tocols include the mixed-state protocols, those are obtained 
from the protocols exploiting more than three states by omit- 
ting the annoucement of the redundant state information in 
the classical communication steps. 

We have investigated the security of the protocols against 
the individual beam splitting attack. We showed that the 
improvement of the key gains is simply proportional to the 
efficiency and no substantial difference is observed whether 
the protocol is mixed-state version or not. This result is de- 
pending on the way of our analysis and it leaves an open 
question whether the modified protocols provide physically 
different condition in the security of QKD particularly on the 
relation with the introduction of the mixed states. 

There exist several possibilities to make other protocols. 
Trivial one is to increase the way of phase modulations. To use 
asymmetric configuration or biased choice of basis |Tg|| may be 
interesting. Extensive search of protocols and optimization of 
efficiencies are left for future works. 



APPENDIX A: FIDELITY BETWEEN THE 
MIXTURES OF TWO COHERENT STATES 

We derive a formula of the fidelity between the mixtures of 
two coherent states 



P = 5(|a>H + l/?></3|) (Al) 
a = l(\- a )(-a\ + \-p)(-f3\) (A2) 

with a = a + ib, (5 = a — ib, (a, b > 0). A phase-space config- 
uration of the states is shown in FIG.|0| Since we can write 

1 



v^3 = —^^TT^l+X+l + yr^l-X-lj (A3) 

where we defined an orthonormal basis which diagonalizes p 

\a) ± 6*^1/3) 



ye** = </3ja), 7 >0, 



(A4) 
(A5) 
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FIG. 9: Phase-space picture of the mixtures of two coherent 
states 



we can find a matrix representation of \fpo\fp as 



W/s(|+> (i±tK+!-I+) yi-7 2 <+l*|-> 



l + e" 4b +2e- 2b cos(4afo) 
2ie~ 262 sin(4afc) 



1 + e" 



-2ie- 26 sin(4a6) 
462 - 2e- 2ft2 cos(4a6) 



(A6) 



Then, using the relation TrV^ = VTrX + 2\/detT for a 2x2 positive matrix X, we obtain the fidelity 



F(p, a) = TrV V&Vp = \l Tr ( VP^VP) + 2 V det ( VWp) = e" 2 " 

I 



(A7) 
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